AI Finds Critical PHP Flaws: Websites Go Offline Globally as OpenAI Coordinates Response

According to ITmedia, on the evening of October 21, Japanese Prime Minister Sanae Takaichi issued an urgent appeal on X: website operators should prepare to install PHP security patches as quickly as possible; if rapid updates prove difficult, temporarily taking websites offline is another viable way to mitigate risk.

The underlying risk is that in runtime environments satisfying specific exploit prerequisites, an unauthenticated attacker could issue crafted network requests to read sensitive data residing in server process memory, or even force PHP or web service processes to execute malicious actions. The flaw resides in the core PHP engine on which vast numbers of websites depend: it renders web pages and processes incoming user data on the server, meaning higher-level application code can be affected even when written without flaws of its own. How much damage an attack can inflict ultimately depends on the runtime environment, the privilege levels of service processes, and system isolation boundaries.

These emergency measures have already disrupted government portals, public services, and everyday websites. According to a compilation by Reuters, the National Cyber Security Centre of the Netherlands, the Port of Rotterdam, and Finnish public web services initiated precautionary shutdowns, while the German federal IT service provider ITZBund took several websites offline. The Ministry of Finance of Japan suspended select web pages and online services; maintenance targets listed in reporting by ITmedia also encompassed online services associated with BASE, pixiv, Cygames, and others. These represent records of service suspensions and maintenance windows at that moment—several have since resumed normal operations—and they should not be taken as evidence that any of these services suffered confirmed intrusions.

The disruption also rippled outward to the platforms supporting these websites. The Wikimedia Foundation proactively deactivated numerous auxiliary services, including components within Toolforge and Cloud VPS, while striving to keep the primary encyclopedia online. Several Japanese hosting providers likewise initiated emergency maintenance: some temporarily suspended customer websites, while others suspended their own administrative consoles while keeping customer servers operational. These divergent operational choices determined whether end users could browse public sites, access control panels, or wait for services to come back online.

According to statistics from W3Techs, approximately 70% of websites whose server-side programming language can be identified rely on PHP. This metric reflects the immense scope of shared technical dependency across the web, rather than the proportion of sites that have actually been breached. In a discussion on Reddit, a user asked whether their browser, mail client, or personal cloud storage was also affected. Here, responsibilities must be clearly delineated: PHP updates on these websites are handled server-side by site operators or hosting providers; general visitors should monitor official status advisories, follow service restoration updates, and carry out any subsequent account hygiene requested by their providers.

Throughout this response, OpenAI participated in coordination between open-source maintainers and hosting providers under its Patch the Planet initiative, and open-sourced a lightweight checking tool to screen for affected versions. AI assisted security researchers in verifying complex attack chains, but ensuring that patches actually protect operational websites still requires concerted action across the entire service delivery chain.

Division of Labor in AI-Assisted Research: Domain Expertise and Model Augmentation

According to OpenAI's official announcement, within the Patch the Planet initiative, security firm Calif discovered a critical vulnerability using GPT-5.6 Sol; the research team at Wiz independently uncovered and reported both flaws; and the definitive remediation and release engineering were led by core PHP maintainers.

A look at the backstory reveals that the underlying flaw had not gone entirely unnoticed in the past. According to a retrospective notice from The PHP Foundation, during an audit funded by the Sovereign Tech Agency and conducted by Quarkslab, maintainers noticed anomalies along the out-of-memory (OOM) handling path while addressing related issues. At the time, however, there was no conclusive evidence demonstrating that this execution path could be escalated to remote code execution. Modifying core memory management logic threatened compatibility with third-party extensions, and the project's consensus-driven decision-making struggled to settle on trade-offs. With limited engineering bandwidth, remediation efforts were repeatedly deferred.

During this discovery cycle, AI models served primarily as analytical aids and adaptation accelerators. In a technical analysis by Calif researcher Ryan Austin, the initial discovery utilized publicly available models; the decisive breakthrough came from combining his deep domain understanding of Stefan Esser's historical vulnerability research from years prior with actively prompting the model to scour the codebase for specific patterns capable of bypassing request limits and triggering abnormal aborts. Austin emphasized that understanding the architectural history of the target system remains indispensable, and current models cannot unearth every vulnerability through simple prompting alone.

In research conducted by Wiz, the team paired its internal Wiz Atlas platform with Gemini 4 Argon and GPT-5.6 Sol. Wiz reported that a single researcher completed work that previously would have taken an entire team months within one week, and stated that models helped adapt the exploit across multiple applications in a matter of hours. In practice, when confronted with divergent memory layouts across various PHP versions and applications, the models assisted researchers in analyzing runtime errors and tuning exploit parameters, lowering the manual barrier of repetitive trial-and-error across different deployment targets. In a sample discussion on Hacker News, commenter asbv-1qq pushed back against the promotional tone of the announcement, questioning the undisclosed compute expenditures behind model search and exploit generation. This provides another essential lens when evaluating claims of accelerated productivity: how much wall-clock time was invested, and how much compute power was consumed in the process.

Additionally, the $1 billion in support referenced in OpenAI's announcement represents pre-existing model access credits under its Daybreak initiative for frontline defenders—primarily designed to assist organizations safeguarding critical infrastructure on constrained security budgets—rather than emergency funds earmarked specifically for this vulnerability. OpenAI noted that support for open-source maintainers also encompasses model access, direct engineering assistance, Codex for OSS subscriptions, and sponsorships for organizations such as the Rust Foundation, with individual projects retaining full autonomy over their priorities. The announcement also acknowledged that classifiers designed to block malicious use can inadvertently impede legitimate security research, necessitating ongoing calibration between preventing misuse and equipping defenders with adequate capabilities.

Requests, Aborts, and Dangling Pointers: Anatomy and Impact of Two Memory Flaws

The internal mechanics of the PHP interpreter become easier to grasp if one envisions its request-handling workflow as an assembly line workstation.

On websites powered by persistent PHP processes, an incoming web page or form request requiring PHP processing is handed off by the web server to a PHP worker process (Worker). The Worker places its components on an isolated heap memory allocation created for that request—a dedicated "workbench"—parsing incoming payload data and building internal variable tables. Once the script finishes execution, cleanup routines wipe the workbench clean, allowing the persistent Worker to process the next incoming web request.

The two disclosed vulnerabilities exploit abnormal aborts at two distinct junctures: when data on the workbench is only half-assembled, and right after an earlier request's workbench has been torn down.

CVE-2026-109618: Memory-Limit Aborts and Mishandling of Partially Initialized Data

According to the official PHP security advisory and a technical advisory from CERT-EU, this vulnerability carries a CVSS score of 9.2. Internally, PHP enforces a per-request memory quota (memory_limit) to guard against resource exhaustion. When a specially crafted request forces memory allocations to hit this threshold, low-level runtime mechanisms abruptly abort ongoing parsing and execution.

According to CERT-EU's analysis, the root cause lies in the fact that when a request is forcefully terminated by an out-of-memory exception, certain internal data structures remain only partially initialized; the subsequent request cleanup routines mistakenly treat these incomplete structures as valid objects during processing and deallocation, corrupting the memory state.

CVE-2026-109619: Reuse of Dangling State Following Request Teardown

According to the second official security advisory and CERT-EU documentation, the root cause of CVE-2026-109619 stems from residual state spanning multiple requests.

When a request terminates abruptly due to a fatal error, the workbench memory allocated to that request is released. In affected versions, however, certain global states inside the engine retain references pointing back into that deallocated memory region. Before that state is fully reset, a subsequent request processed by the same Worker process can mistakenly reuse these dangling pointers, leading to memory access across regions that are already invalid or have been overwritten by new data.

Consequences of Memory Corruption

The consequences of these memory corruption bugs fall into two primary categories:

1. Sensitive Memory Disclosure: When stale or dangling memory pointers are mistaken by the engine for legitimate application data and outputted—such as in HTTP response headers or cookies—an attacker can inspect fragments of process memory without needing code execution privileges. This data may encompass sensitive information from other requests or resident in server process memory, including session credentials, API keys, or passwords.
2. Remote Code Execution (RCE): Applications do not use memory solely to store user payloads; they also rely on internal pointers and object references to determine which routines to execute next and which operations to perform. If an attacker carefully crafts request payloads that corrupt these memory layouts, causing attacker-controlled data to be treated as valid internal structures, subsequent execution flows deviate from their intended paths; via complex exploit chains, attackers can hijack execution flow and coax the interpreter into executing injected malicious logic. The attacker gains the privileges already held by the PHP or web service worker process; the actual blast radius is governed by the permissions and sandboxing constraints of that execution context.

In a technical deep dive by security firm Wiz, researchers illustrated the progression of both attack vectors:

The interplay between request aborts, residual state, and worker process survival can be traced through the flow below:

mod_php vs. PHP-FPM: How Runtime Architecture Shapes Exploitation Paths

Official PHP communications and CERT-EU advisories note that legacy Apache mod_php represents the highest-risk deployment model, whereas modern and widely deployed PHP-FPM architectures exhibit markedly different exploitation conditions.

The core distinction hinges on whether the Worker process survives an abnormal termination to serve subsequent requests:

• Under the Apache mod_php architecture, PHP executes as an in-process module embedded directly within Apache child processes. Official advisories indicate that under default configurations, an unauthenticated request can trigger startup-phase memory errors prior to the execution of any application-level code, demonstrating remote code execution. In this mode, even when request startup parsing aborts abnormally, request teardown routines still execute, and the surviving child process can reuse the corrupted state. However, this represents a specific demonstration path and does not imply that every vulnerable mod_php deployment can be unconditionally compromised with a single request.
• Under the PHP-FPM architecture, a separate process pool manages worker processes. If a fatal error occurs during the early request initialization phase, FPM's internal mechanics terminate the offending Worker process immediately, cutting off certain exploitation paths predicated on startup-phase residual state. However, if a request successfully passes initialization and triggers a memory-limit abort during application execution—such as within complex data deserialization or error-handling routines—the Worker process may survive and pick up subsequent requests. Researchers confirmed working remote code execution paths under PHP-FPM during application execution as well.

Coordinated Vulnerability Disclosure: Timeline Dynamics and Operational Responses

Responsible coordinated disclosure is designed to afford open-source maintainers, Linux distributions, and infrastructure providers sufficient lead time to formulate defenses and validate patches. This process is not synonymous with binding non-disclosure agreements across all participants, nor can it guarantee that every end user will upgrade seamlessly the moment details are published.

According to post-incident accounts from The PHP Foundation and industry reporting, this coordinated disclosure process weathered multiple schedule shifts and unexpected friction:

1. Leaked Identifiers and Scores: Two days prior to the planned public release, the two CVE identifiers alongside an exaggerated CVSS score of 10.0 (the actual assessed score was 9.2) began circulating on technical forums and social platforms, though granular technical mechanics remained unrevealed at that stage.
2. Accelerated Release Schedule: To address mounting public attention while balancing distributor lead times, the PHP team issued a preliminary heads-up notice and advanced the official patch release by one full day.
3. Accidental Demonstration Video Leak: Following the heads-up notice, security firm Calif accidentally published a verification video demonstrating the exploit; although quickly taken down, the recording was archived and circulated by third parties, exposing partial vulnerability mechanics.
4. Early Container Image Publication: Approximately six hours before the coordinated embargo lift, container security provider Chainguard built and pushed container images containing the fixes.
   • The PHP Foundation's Position: In its retrospective, the Foundation stated that releasing patched binaries ahead of schedule enabled attackers to perform binary diffing to pinpoint the exact fix locations, disrupting multi-stakeholder synchronization.
   • Chainguard's Response: According to reporting by The Register, Chainguard's CEO decided to push the patch early to shield customers upon witnessing spreading PoC materials and reports of active exploitation, notifying the coordination channel concurrently with the release.

Regarding threat activity, Reuters quoted Amazon Chief Information Security Officer CJ Moses stating that honeypot systems had captured anonymous probing attempts several days before public disclosure. While security teams had identified the vulnerabilities earlier, and it remains unconfirmed whether those early probes successfully breached any production environments, it indicates that exploratory attacks were already underway prior to formal disclosure. Subsequently, Cloudflare's technical blog documented that its edge defense systems observed sustained malicious traffic around the disclosure window, with adversaries continually mutating payloads to evade WAF rule sets.

Five-Phase Global Coordination and Long-Term Security Pathways

Faced with foundational software vulnerabilities spanning the global internet ecosystem, OpenAI stated in its announcement that these PHP flaws represent just one batch among multiple critical security exposures it has identified and is currently working to remediate. Anticipating a sharp increase in AI-assisted vulnerability discoveries going forward, the organization argued for a repeatable coordination framework that expands alongside advancing capabilities, outlining a "Five-Phase Response" model that maps the journey from an upstream code commit to widespread real-world protection:

1. Validate and Patch Upstream Vulnerabilities: Maintainers and security research teams confirm root causes and test candidate fixes. This requires not only verifying patch efficacy, but also conducting adversarial testing to look for variants and potential ways to bypass the patch.
2. Provide Lead Time to Critical Defenders: Upstream maintainers determine invitees based on each organization's defensive purview, deployment lead times, and capacity to handle sensitive intelligence. Distributors must adapt fixes for older versions, hosting providers must test mitigations, and security vendors must validate Web Application Firewall (WAF) signatures. Information shared is tiered by necessity—ranging from IOC-laden network telemetry to sensitive runnable exploit proofs—demanding a delicate balance between broadening defensive coverage and preventing premature leakages.
3. Engage Government Agencies to Protect Critical Infrastructure: Coordinate with national cybersecurity authorities to funnel actionable remediation guidance into critical infrastructure operators and public sector bodies.
4. Drive Downstream Ecosystem Readiness: As patches stabilize, broaden outreach to downstream platform vendors and hosting environments, preparing turnkey deployment packages to close lingering coverage gaps.
5. Issue Public Guidance and Support Implementation: Publicly release vulnerability advisories and patches, providing continuous operational guidance for upgrade verification and incident triage.

Across this chain, each stage demands deliberate time because hastily shipping unverified patches risks breaking widespread application compatibility. If exploitation appears in the wild, accidental leaks occur, published patches reveal flaws, or stalled remediation increases risk, the coordination coalition must reassess and recalibrate disclosure timelines.

Looking toward the horizon, OpenAI's announcement outlined four foundational security vectors: adopting secure-by-default configurations at the source and eliminating high-risk idioms; migrating critical components to memory-safe languages to structurally eradicate common classes of memory safety bugs; applying formal verification to mathematically prove that critical components satisfy specified security properties under explicit assumptions; and establishing tighter sandbox isolation boundaries around software processing untrusted files or media, confining blast radiuses even if worker processes are compromised. AI can assist by aiding code comprehension, drafting migration changes, and writing tests, but rigorous engineering tests and expert review remain mandatory to preserve expected application behavior. The announcement also solicited feedback on an extreme scenario: whether vulnerabilities should be used, under specified conditions and safeguards, to patch systems that governments or other operators own or are authorized to manage but can no longer access administratively—a concept that remains open to extensive debate regarding legal authority and security boundaries.

Concurrently, The PHP Foundation underscored that while AI tools dramatically accelerate the velocity of incoming vulnerability reports, maintainers also triaged over one hundred invalid, duplicate, or unreplicable submissions; filtering reports, weighing architectural trade-offs in patches, and conducting compatibility reviews still rely squarely on seasoned core maintainers. As report volumes swell, the human review and engineering bottlenecks facing open-source projects become ever more acute, making sustained funding and engineering bandwidth the indispensable bedrock of foundational software security.

From Upstream Patches to Production Safety: Version Support and Mitigation Limits

Once official upstream security patches are tagged, they must still pass through downstream packaging and hosting provider deployment before administrators can verify that the live PHP instances serving traffic have actually been updated. Hacker News commenter spenvo recounted waiting for container images: even after the release tag appeared, official container images for specific CPU architectures had not yet completed building. That real-time personal experience vividly illustrates the latency between "released upstream" and "ready to deploy in production."

Provider-level maintenance also yielded varied operational impacts. IDC Frontier's Zenlogic announcement scheduled PHP upgrades and patching from 22:00 JST on October 21 to 18:00 on October 22. Its notice said Apache would stop during the work, making customer websites and Roundcube webmail inaccessible, while mail-client send/receive and FTP would be unaffected. GMO Pepabo's Lolipop maintenance page similarly detailed suspensions across legacy shared hosting plans—including customer websites, user management portals, FTP, and legacy webmail—while detailing distinct service availability across its newer product lines.

XServer's announcement illustrated a different posture: taking down its own corporate website and customer administrative panels while keeping customer hosting servers running as patching proceeded. On October 22, a status update at 09:30 JST reported that administrative functionality had been partially restored, following an earlier notice at 06:45 that target servers running PHP 8.2–8.5 had finished patching, with legacy versions handled separately. Consequently, encountering a "provider maintenance" notice requires discerning whether the outage affects administrative portals or the underlying customer services themselves.

Fragmented administrative control further elongates recovery timelines. The Wikimedia Foundation noted that select services within Toolforge and Cloud VPS are maintained by volunteer developers who select their own PHP runtime versions; the Foundation had to coordinate directly with individual service owners to execute patches, so these services could take longer to restore.

1. Divergence Between Active Branches and Legacy Environments

The PHP project issued official security releases for the four actively supported lifecycle branches: 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

For end-of-life (EOL) branches, upstream maintainers no longer provide routine security releases. According to Censys scan data cited by Reuters, out of a sample of 2.6 million hosts running identifiable PHP versions, approximately 1.5 million were running branches lacking official pre-built updates at the time. In early community discussions, a developer on the V2EX forum voiced acute concern over legacy deployments still tethered to PHP 7 environments. While upstream maintainers do not issue regular security releases for deprecated branches, that does not mean all remediation is absent: given the severity of the threat, the PHP security team took the exceptional step of publishing minimal source backport patches for PHP 7.4, 8.0, and 8.1 for users who compile from source; select Linux distributions and Long-Term Support (LTS) vendors also offer patched maintenance packages depending on their distribution and support coverage. Nonetheless, on legacy systems lacking continuous engineering maintenance, major-version upgrades carry heavy compatibility burdens—including deprecated syntax, broken extensions, and obsolete dependencies—precluding rapid migration.

2. Scope and Limitations of Temporary Mitigations

For production environments unable to apply upstream updates immediately, CERT-EU and security advisories suggested several interim configuration tweaks; however, each carries stringent prerequisites and cannot replace a proper binary upgrade:

• Disabling Upload Progress (session.upload_progress.enabled = 0): This setting severs confirmed exploit chains predicated on session upload progress mechanisms, but it must be active prior to request parsing, requires restarting all worker processes, and offers no protection against alternative trigger vectors.
• Removing Per-Request Memory Quotas (memory_limit = -1): By eliminating the memory ceiling on individual requests, this configuration prevents execution flows from tripping quotas and tumbling into vulnerable abort-cleanup routines. However, this comes at the cost of availability defenses. Once per-request limits are removed, abnormal requests are no longer throttled by PHP's memory quota, requiring operations teams to enforce OS-level container limits or cgroup memory boundaries to prevent system-wide exhaustion. Crucially, these boundaries cannot simply be substituted with RLIMIT_AS or RLIMIT_DATA limits, which would likewise trigger low-level memory allocation failures within the process; moreover, if physical memory exhaustion forces low-level OS allocation failures, the runtime could still enter vulnerable cleanup paths.

Tuning production configurations requires expert evaluation and regression testing; interim mitigations merely reduce exposure across specific vectors, and complete resolution still demands updating PHP.

Version Checking Tools: Operational Scope and Inherent Blind Spots

Alongside the coordinated disclosure, OpenAI open-sourced a lightweight diagnostic tool, php2shell-checker. The tool is designed primarily for initial version triage against a single URL or a local PHP binary; it is not built for automated wide-scale internet scanning or bulk asset discovery.

Its network probing mechanism defaults to sending an HTTP HEAD request, falling back to GET only if the server returns a 405 or 501 status code; it does not follow HTTP redirects, nor does it read or parse response bodies. If the connection fails, the target suppresses version headers, or an unindexed branch is encountered, the tool returns UNKNOWN.

When presented with an outdated release, a patched version, absent version metadata, or a vendor-backported build, the version checker produces distinct outputs. The strength of evidence behind each result varies considerably.

Tool Invocation and Workflow

When verifying sites under your management, you can install the corresponding skills within a Codex-supported environment according to repository instructions: use phpcheck-url to inspect public URLs, or use phpcheck-server when administrative server access is available to inspect the PHP binary handling production web traffic.

If running locally via Node.js, clone the complete repository and navigate to its root directory in your terminal. Ensure a functioning Node.js runtime is installed, then execute the commands against domains you manage or your local environment (https://example.com is a placeholder and should be replaced with your actual domain; the tool performs version comparisons only and does not attempt to exploit vulnerabilities):

node phpcheck.js "https://example.com" --json
node phpcheck.js --local --json

Four Inherent Blind Spots in Version Comparison

In operational evaluations, version comparison results cannot be equated directly with proof of system security. Keep the following blind spots in mind:

1. Hidden or Suppressed Response Headers: Production servers frequently disable expose_php or strip version headers at the reverse proxy or API gateway layer, causing the tool to return UNKNOWN due to missing metadata. UNKNOWN signifies that available data is insufficient to assess patch status.
2. Linux Distribution Backporting: When Linux distributions backport security fixes, they typically retain the original upstream version string, differentiating patched builds solely through package revision suffixes. The tool checks only the upstream version string and may flag a patched distribution package as VULNERABLE; administrators must consult vendor security advisories and inspect the full package release string.
3. CLI Environment vs. Live Web Runtime: Running php -v in a terminal displays the binary associated with the current shell environment, whereas the backend processes handling web requests through Nginx or Apache may be served by an entirely different PHP-FPM pool or isolated container, with different versions or build options.
4. OK Only Reflects Version Numbers Above Built-In Thresholds: An OK status rests entirely on the assumption that subsequent stable releases incorporate the upstream patch; the tool does not independently test whether vulnerability triggers can be executed in process memory.

Operations teams should cross-reference complete package release strings and active web-facing runtime builds against official security advisories from their operating system vendor or distributor. Once upgrades are installed, follow vendor procedures to restart associated PHP-FPM pools or Apache services, or redeploy container images to ensure workloads have cleanly transitioned to patched binaries.

Software upgrades remediate underlying flaws; if an environment was previously compromised, administrators must still investigate and address any traces of intrusion. During remediation windows, full-transaction WAF rules deployed by providers can help mitigate known payload patterns, but they cannot substitute for low-level patches. If rapid patching is unfeasible and perceived risk is acute, consider temporarily isolating affected services from the public internet in accordance with your network architecture.